     (is (bb/bytes= ptext (aead/chacha20poly1305-decrypt ctext ad nonce k)))
     (is (bb/bytes= ptext (aead/chacha20poly1305-decrypt
                           (aead/chacha20poly1305-encrypt ptext ad generated-nonce generated-keygen)
-                          ad generated-nonce generated-keygen)))))
+                          ad generated-nonce generated-keygen)))
+    (is (thrown-with-msg?
+         RuntimeException #"Ciphertext verification failed"
+         (aead/chacha20poly1305-decrypt (rand-bit-flip ctext) ad nonce k)))))
 
 (deftest chacha20poly1305-encrypt-decrypt-detached-test
   (let [k (aead-chacha20poly1305-vector "key")

        ad (aead-xchacha20poly1305-ietf-vector "ad")
        nonce (aead/new-xchacha20poly1305-ietf-nonce)
        {:keys [c mac]} (aead/xchacha20poly1305-ietf-encrypt-detached ptext ad nonce k)]
    (is (bb/bytes= ptext (aead/xchacha20poly1305-ietf-decrypt-detached c mac ad nonce k)))))

        {:keys [c mac]} (aead/chacha20poly1305-ietf-encrypt-detached ptext ad nonce k)]
    (is (bb/bytes= ctext c))
    (is (bb/bytes= mtext mac))
    (is (bb/bytes= ptext (aead/chacha20poly1305-ietf-decrypt-detached ctext mac ad nonce k)))
    (is (thrown-with-msg?
         RuntimeException #"Ciphertext verification failed"
         (aead/chacha20poly1305-ietf-decrypt-detached (rand-bit-flip ctext) mac ad nonce k)))))

(deftest chacha20poly1305-ietf-keygen-test
  (let [ks (set (repeatedly 100 aead/chacha20poly1305-ietf-keygen))]
    (is (= 100 (count ks)))
    (doseq [^ByteBuffer k ks]
      (is (= aead/chacha20poly1305-ietf-keybytes (.limit k))))))

(def aead-chacha20poly1305-vector
  (comp v/hex-resource (partial str "vectors/aead/chacha20poly1305/")))
